Deployment Architecture

scripted inputs execution interval

bwenge
Explorer

I have deployed the unix app on universal forwarder.How to change default execution interval for the scripted inputs?

Tags (2)

Ron_Naken
Splunk Employee
Splunk Employee

For the *NIX app, the scripted inputs can be found in $SPLUNK_HOME/etc/apps/unix/default/inputs.conf. Copy the parameters you want to change, and place them in $SPLUNK_HOME/etc/apps/unix/local/inputs.conf. If you modify the values in /default, they will be overwritten when your app is updated to a new version.

Note the "interval" parameter in the iostat.sh stanza in inputs.conf:

[script://./bin/iostat.sh]

interval = 60
sourcetype = iostat
source = iostat
index = os
disabled = 1

HTH

Ron_Naken
Splunk Employee
Splunk Employee

Copy the stanza into $SPLUNK_HOME/etc/apps/unix/local/inputs.conf and override whatever values you want to change in the new file. For instance, set interval=. Values specified in conf files in /local will override those in /default

0 Karma

bwenge
Explorer

What do you mean by "Note the "interval" parameter in the iostat.sh stanza in inputs.conf",it means that default interval execution can not be changed for iostat.sh and it is all time equal 60

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...